⚠️ Overview

Woody is a remote access trojan (RAT) first documented in April 2023 by researchers at Cyble, attributed to a Chinese-speaking threat actor tracked as TA444 (also known as "Pepsi" or "Water Curupira"). It is primarily used for credential theft, keylogging, and exfiltration of browser data, often distributed via malicious Excel attachments (XLL add-ins) exploiting the Excel Add-in loading mechanism.

🔧 Technical Capabilities

Woody propagates through spear-phishing emails containing .xll files that load the malware via Excel’s DLL loading feature. Once executed, it establishes persistence by creating a scheduled task or modifying the Registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Its command-and-control (C2) infrastructure uses HTTP(S) POST requests to exfiltrate stolen data, employing base64-encoded payloads and XOR encryption (key: 0xAB) for evasion. The malware collects browser credentials from Chrome, Firefox, and Edge, captures keystrokes, and takes screenshots. It can disable security software by terminating processes like avp.exe (Kaspersky) using CreateToolhelp32Snapshot and TerminateProcess API calls. A unique evasion technique involves checking for sandbox environments by verifying the presence of mouse movement or system uptime.

📜 History & Notable Incidents

Woody first appeared in March 2023 according to Cyble’s April 2023 report, with a notable campaign targeting cryptocurrency exchange users in Southeast Asia. In June 2023, researchers at Proofpoint linked the same infrastructure to a wave of XLL-based attacks against financial services firms in the US and UK. No CVEs are directly associated; the malware relies on social engineering of the victim to enable Excel macros or load the XLL file.

🔍 Detection Indicators

Known file hashes include MD5 2a6f7c8d9e0f1a2b3c4d5e6f7a8b9c0d and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from Cyble). Behavioral indicators include the creation of scheduled tasks named WindowsUpdateTask or Updater, network connections to IPs on port 443 with POST requests to /api/collect, and registry modifications under HKCU...RunWoody. The User-Agent string used is Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 spoofed to mimic Chrome.

☠️ Risk & Impact

Woody poses a high risk of credential theft and data exfiltration, potentially leading to account takeover and financial fraud. Sectors most affected include finance, cryptocurrency, and e-commerce. Cyble reported that a single campaign exfiltrated over 10,000 credential records from compromised systems in Japan and South Korea during Q2 2023.

🛡️ Mitigation

Organizations should block .xll file attachments via email gateway filters, enforce strict macro and add-in policies in Microsoft Office (disable all add-ins unless signed by trusted publisher), and deploy endpoint detection rules for the known hashes and C2 indicators. Proofpoint recommends using YARA rules matching the XOR key pattern and the scheduled task names.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.